[Solved] How do I add "Controlled Folder Access" for Apache?

[Penda]

Windows 10 "Defender" is stopping Apache (version 4.1.13) from adding or modifying text documents.
I have found the "setting" to add new "apps" to the list of apps with "Controlled Folder Access" BUT how do I add Apache ?
The Windows defender message specifically states that the program "soffice.bin" was blocked.
I'm wary about switching the "Controlled" access OFF in case some nasty person/program gets in.

[LastUnicorn]

How to Add Exclusions in Windows Defender on Windows 10

You can make an Exclusion for the whole folder containing OpenOffice, or just make an Exclusion for soffice.bin (and see how you get on with that).

Another alternative would be to try LibreOffice. For reasons unknown, Defender generally tolerates LibreOffice somewhat better than OpenOffice. There are several good reasons for switching from OpenOffice to LibreOffice, some of which are given in this thread: [Tutorial] Considering a Switch from OpenOffice to LibreOffice? Some Useful Information

[Penda]

Thank you for the reply, LastUnicorn, but I may not have explained the problem adequately. I don't mind "Defender" scanning the files containing the Apache programs. The problem is that when using Apache on a text document, windows will not allow the amended or new document to be stored. I need to add Apache programs to those which are allowed to update the "Documents" files to prevent the "Controlled Folder Access Blocked" message from appearing.

[LastUnicorn]

To me it still sounds like you need to add a Defender Exclusion for (at least) soffice.bin. Try that anyway, it will only take a few seconds to do so, and see if that cures the issue. If it doesn't then you can remove the Exclusion in a few seconds too.

For more detail see these:
Controlled Folder Access blocked
Allow an app to access controlled folders

Again, you would be better switching to LibreOffice anyway.

[LastUnicorn]

Oh, I get it on further searching I found this which explains the Controlled Folder Access capability much better: FIX: Controlled Folder Access blocks program from making changes to memory. (Solved)

I had that Controlled Folders Access capability switched off in my own system and so have never had occasion to look in there. I'm off to experiment with it now.

[LastUnicorn]

Did a quick test of this Controlled Folder Access (CFA) on my own system and, after a reboot, three programs were blocked by it that I know to be not malware. Easy to fix, the fix is to add Exclusions in CFA for the (in my case) .exe files that were being blocked by the CFA.

I also tested it with my OpenOffice Portable but no issue was flagged for that. Likewise with LibreOffice, no issues.

So if I now stick with CFA then I know in future that exclusions for programs might have to made in both Defender Antivirus (Virus and threat protection) and in CFA (Ransomware Protection).

[LastUnicorn]

On a little more research found this article which is cautionary on enabling CFA: Think twice before deploying Windows’ Controlled Folder Access

It seems the article is/was written with tech administrators in mind, but the general principles would apply to all users anyway.

[Penda]

Thank you again for your efforts LastUnicorn, but I seem to have now sorted this problem. Anybody with the same issue please read on .........

* Go to the "Board Index / Getting Started / Tutorials" section of this Forum.
* Find the tutorial titled "Problems with Windows Defender under Windows 10" posted by John_Ha on March 26th, 2019.
* Follow the tutorial precisely, especially manually typing "soffice.bin" at the end.

This Apache program (soffice) will then be allowed to add or modify text documents whilst "Defender" will still control folder access.

The procedure is not totally intuitive and may cause difficulty for someone without a computer background. Having worked with IBM mainframe software for several decades of my life and being fairly familiar with the business practices of that once giant of the computer world, I must say that Microsoft unfortunately seems to be following some of IBM's undesirable practices. To have to carry out this procedure just to be able to use third party software, (such as Apache), is an abomination.

[Villeroy]

Nowadays nobody is forced to use MS Windows. Since 21 years I run Linux on all of my private desktop machines, on servers anyway.